Classifications

• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C9/00—Individual registration on entry or exit
  • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
  • G07C9/00182—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with unidirectional data transmission between data carrier and locks
• • E—FIXED CONSTRUCTIONS
  • E05—LOCKS; KEYS; WINDOW OR DOOR FITTINGS; SAFES
  • E05B—LOCKS; ACCESSORIES THEREFOR; HANDCUFFS
  • E05B49/00—Electric permutation locks; Circuits therefor ; Mechanical aspects of electronic locks; Mechanical keys therefor
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q10/00—Administration; Management
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C9/00—Individual registration on entry or exit
  • G07C9/20—Individual registration on entry or exit involving the use of a pass
  • G07C9/27—Individual registration on entry or exit involving the use of a pass with central registration
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
  • H04L63/102—Entity profiles
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/50—Network services
  • H04L67/56—Provisioning of proxy services
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/50—Network services
  • H04L67/56—Provisioning of proxy services
  • H04L67/568—Storing data temporarily at an intermediate stage, e.g. caching
  • H04L67/5683—Storage of data provided by user terminals, i.e. reverse caching
• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B66—HOISTING; LIFTING; HAULING
  • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
  • B66B1/00—Control systems of elevators in general
  • B66B1/34—Details, e.g. call counting devices, data transmission from car to control system, devices giving information to the control system
  • B66B1/46—Adaptations of switches or switchgear
  • B66B1/468—Call registering systems
• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B66—HOISTING; LIFTING; HAULING
  • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
  • B66B2201/00—Aspects of control systems of elevators
  • B66B2201/40—Details of the change of control mode
  • B66B2201/46—Switches or switchgear
  • B66B2201/4607—Call registering systems
  • B66B2201/4653—Call registering systems wherein the call is registered using portable devices
• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B66—HOISTING; LIFTING; HAULING
  • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
  • B66B2201/00—Aspects of control systems of elevators
  • B66B2201/40—Details of the change of control mode
  • B66B2201/46—Switches or switchgear
  • B66B2201/4607—Call registering systems
  • B66B2201/4676—Call registering systems for checking authorization of the passengers

Definitions

• the present invention relates to the management of access rights. More particularly, the present invention relates to a method and to a system for managing the access rights of companies and other organizations in a centralized system.
• a simple method to prevent the access of outsiders to secured premises is to lock the premises and assign keys to the possession of only those persons who each have the right of access to said premises.
• different access control systems can be used, in which information about the currently valid access rights is stored in the database of the system. In this case reading devices must be installed in connection with the doors, by means of which the access rights can be verified e.g. using access cards, PIN codes or RFID identifier tags.
• access cards e.g. using access cards, PIN codes or RFID identifier tags.
• the management of physical means, such as keys and access cards, in large and/or changing organizations is awkward and expensive and includes significant security risks.
• Locally installed access control systems are complex and relatively expensive, especially if the number of secured locations is small.
• Access rights and other such usage rights are often dynamic by nature, in other words they can change from one person or organization to another, the access right can be limited in terms of time or of the number of times it is used.
• the management of dynamic access rights in existing access control systems is awkward, especially if the number and/or situation of locations connected with the access rights change. Problems also occur if a number of different customers must gain access to the same premises to perform tasks according to their duties.
• the solution generally used in this case is that each company arranges their own access control to the relevant locations, in which case the overall solution is ineffective and expensive.
• the purpose of the invention is to eliminate the aforementioned problems of prior art and to provide a completely new solution for implementing the management of the access rights of companies and other organizations (in this context contractors) in a centralized system. With the invention it is endeavored to achieve one or more of the following objectives :
• the method according to the invention is characterized by what is disclosed in the characterization part of claim 1.
• the system according to the invention is characterized by what is disclosed in the characterization part of claim 11.
• Other embodiments of the invention are characterized by what is disclosed in the other claims.
• Some inventive embodiments are also discussed in the descriptive section of the present application.
• the inventive content of the application can also be defined differently than in the claims presented below.
• the inventive content may also consist of several separate inventions, especially if the invention is considered in the light of expressions or implicit sub-tasks or from the point of view of advantages or categories of advantages achieved. In this case, some of the attributes contained in the claims below may be superfluous from the point of view of separate inventive concepts .
• a method for managing the access rights of at least one contractor in a system, which comprises the main system of the central system, a reverse proxy of the central system, at least one activation device as well as at least one terminal device, which is in the possession of the user of the contractor.
• a customer account is established in the database of the main system, in connection with which the identification data of the aforementioned activation device (so-called activation device data) is stored.
• the configuration data is received via the interface of the reverse proxy, on the basis of which the identification data of the terminal device (so-called terminal device data) , as well as the access rights information connected with the aforementioned terminal devices and activation devices and the one or more additional information items connected with each item of access rights data, is stored in connection with the customer account.
• the access rights recorded On the basis of the access rights recorded the dynamic access rights and the aforementioned additional information is transmitted to the terminal devices of the users.
• the system further comprises an interface of the reverse proxy for receiving configuration information and for recording in connection with a customer account configuration information comprising the identification data of the aforementioned activation device, as well as the access rights data connected with the aforementioned identification data of the terminal devices and of the activation devices, and also the one or more additional information items connected with the access rights data.
• the system further comprises an interface of a reverse proxy for transmitting at least one dynamic access right and one or more additional information items connected with the use right to a terminal device on the basis of the aforementioned access rights data.
• event data connected with access rights is recorded in the event register connected with a customer account.
• customers have available up- to-date information about the users that have visited certain locations, to produce the events reports they desire from the information and/or to monitor in realtime the activation events of the locations.
• an activation device is installed in connection with a door lock and/or a drive prevention device of a vehicle.
• the dynamic position data of an activation device is received and it is recorded in the activation device data of said activation device.
• a location in which an activation device is installed can be a moving location, e.g. a service vehicle, the position data of which is updated in the database of the system.
• the additional information item that is transmitted to the terminal device in connection with the transmission of a dynamic access right is one of the following: an Internet address, a PIN code, guidance information connected with the location, an instruction, or any other additional information whatsoever, which the terminal device identifies and performs the necessary additional functions on the basis of the identification.
• the additional information is the address information to the data or to the system maintained by the customer.
• the terminal device can also be in connection with a server maintained by the customer for implementing the special applications of the customer.
• the additional information can be configured by the customer and can thus easily be changed.
• user groups are formed from the terminal device data that is in connection with a customer account on the basis of the configuration data received.
• the invention activation device groups are formed from the activation devices on the basis of the configuration data received.
• individual access rights data can be allocated to a whole user group and/or activation device group instead of to an individual activation device and/or (terminal device of a) user.
• the embodiments facilitate and speed up the configuration of access rights as well as e.g. the formation and optimization of distribution routes and other such routes .
• the identification data of an activation device is stored in connection with two or more customer accounts.
• the embodiment enables numerous customers to have the right to use the same activation device but to independently specify the access rights connected with the activation device.
• the information connected with a customer account is transferred to be connected with some other customer account.
• the configuration data connected with access rights can easily be transferred from one company to another, e.g. if the forwarding agent responsible for deliveries of a good changes to another forwarding agent.
• the configuration of customer-specific data is easy and fast especially owing to the grouping of activation device data and of terminal device data. It is also easy to add/remove locations to/from the system according the needs of the customer. The customer can also add and configure his own functionalities in connection with the system, in which case his special needs can be addressed better than before.
• the access rights are dynamic, in which case the risk of misuse of the access rights diminishes. All in all as a result of the invention, data security improves and the management of access rights becomes easier.
• Fig. 1 presents one embodiment of the system according to the invention
• Fig. 2 presents the message transmission in one system according to the invention.
• Fig. 3 presents another embodiment of the system according to the invention. DETAILED DESCRIPTION OF THE INVENTION
• Fig. 1 presents one embodiment of the system according to the invention, in which the central system, which comprises the main system 101 and a reverse proxy 102, is marked with the reference number 100.
• the central system is connected to the telecommunications network 110 via the interface 102a of the reverse proxy and further to the mobile phone network 111 for transmitting messages between the reverse proxy and the terminal devices 106 in the possession of the users.
• the telecommunications network 110 is preferably an Internet network, via which the reverse proxy is in connection with equipment and systems that are outside the central system.
• Fig. 1 further contains an activation device, marked with the reference number 104, which is incorporated in the system and which controls the actuator 105 disposed at the location 112, e.g. an electrical lock for opening the door at the location.
• the main system and the reverse proxy are installed by the operator that manages the central system, who is also responsible for the maintenance of it and for the central system operating without interruption in all circumstances.
• the task of the main system is to maintain customer- specific customer accounts and the access rights in connection with them in the database 103 of the main system.
• Customer-specific event registers are also in connection with the main system, in which the main system records information about activation events connected with access rights. For example, when a user (a terminal device) requests access permission to a certain location, information about the event is recorded in the event register concerning who requested the access permission (identification code of the terminal device) , where it happened (identification code of the activation device) and when it happened.
• the main system and the reverse proxy can be implemented as separate systems or they can be integrated as systems functioning in the same computer unit .
• the activation device 104 is a device capable of wireless nearfield communication, in which the messaging connection 109 is based e.g. on Bluetooth technology, infrared technology or some other similar nearfield communication technology. Each activation device belonging to the system has an individual identification code, which it transmits to its environment via a messaging connection. In Fig. 1 the activation device is connected with a simple on/off signal 108 to the actuator 105 for controlling the actuator, e.g. for opening the lock in the electrical lock of a door on the basis of information received
• activation permission from a terminal device. It is not necessary for information to be in the activation device itself about what kind of actuator is connected to it, because the signal transmitted to the actuator comprises only information about the approved activation permission.
• the activation device is thus one of general usage and is suited for connecting to many types of locations such as doors, gates, systems controlling production processes, vehicles, postboxes
• the invention does not limit the interface to simply an on/off signal but instead any interface method at all suited to the purpose of controlling an actuator is possible, e.g. a message transmitted to an actuator via the messaging connection 109 used by an activation device.
• a power supply of the activation device and of the actuator connected to it from an accumulator it is not necessarily needed to arrange an external power supply to the location.
• the terminal device 106 is e.g. a mobile phone, which is able to communicate with both the activation devices and the reverse proxy. Communication with the activation device 104 occurs via the messaging connection 109 used by the activation device. The connection to the reverse proxy occurs via any wireless data transfer network 111 whatsoever, e.g. via a public mobile phone network.
• the primary task of a terminal device is to transmit message traffic connected with an activation event of a location between the activation device disposed in close range and the reverse proxy as well as to function as an interface between the user and other units of the system.
• the terminal device is provided with application software, a so-called terminal device application, by means of which the access right connected with the activation devices can be verified and transmitted as an activation permission to the activation devices.
• the terminal device applications 102b are stored on a customer-specific basis in a server belonging to the system, e.g. in a reverse proxy for downloading to the terminal devices of users.
• the user sends a message, e.g. a text message, with his/her terminal device to the server belonging to the system, in response to which the terminal device receives address information, e.g. an IP address, from where the terminal device application intended for the user can be downloaded.
• address information e.g. an IP address
• the downloading of the terminal device application can occur also automatically such that the user does not need to participate in the downloading event himself/herself .
• the function can be utilized e.g. in connection with the issue of a new software version such that a new program version is automatically downloaded to all the terminal devices of a certain customer or that have the same application program version immediately it is issued.
• the operator For all those contractors who order the access rights management service from the operator maintaining the system, the operator establishes a customer-specific customer account in the database 103 of the main system, in which the operator records the contact information of the customer and other similar customer information. The customer notifies the operator about those locations for which he needs an access rights management service. On the basis of the notification the operator installs activation devices in specified locations, records the identification data of the activation devices (activation device data) in question in the database of the main system and connects the data in connection with the customer account of the customer.
• the activation device data comprises an identification code uniquely specifying the activation device as well as if necessary the address data of the location, position coordinates and/or other general information about the location.
• the activation devices are the property of the operator, who is also responsible for their operation and maintenance.
• the system also enables shared use of the activation devices such that the operator connects the identification data of the activation devices in shared use in connection with the customer accounts of two or more contractors .
• the customers in question can after this configure their own access rights in the locations in shared use without customer-specific activation devices for each customer being installed in the locations .
• the operator activates the customer account of the contractor and delivers the necessary usernames and passwords to the main user of the contractor for configuring the data connected with the customer account.
• Configuration can take place e.g. via an administration terminal 112 or via the information system or some other system of the customer.
• the customer (main user) defines the identification data of those terminal devices (terminal device data) that the organization/users of the company have in their possession.
• Each terminal device data item comprises an individual identification code of the terminal device, e.g. the phone number of the terminal device as well as if necessary general information connected with the terminal device and/or its user.
• the customer configures the user rights he/she wants by associating the identification data of the terminal devices and the activation devices with each other and also by defining a dynamic access right to the associated data.
• a dynamic access right in this context means that the access right can be limited to apply e.g. to a certain period of time and/or number of instances of use. Additionally, it is possible to define in the user rights data whether a dynamic user right is sent in advance to a terminal device or whether the validity of the user right must always be verified from the main system.
• the customer can also configure one or more freely definable additional items of information into the user rights data, which is transmitted to the terminal device in connection with the transmission of the dynamic user right.
• Additional information can be e.g. an IP address to a server maintained by the customer, a PIN code, guidance information or other additional information connected with access rights. All in all, additional information allows the customer to diversely connect his/her own functionalities in connection with the system without the operator himself having to modify the central system or its software.
• the customer can further form groups from the configured terminal device data and from the activation device data on the basis of different criteria, e.g. to form a user group from the terminal device data of users operating in a certain area or to form an activation device group of locations in the same area or on the same distribution route or other such route.
• the grouped data is associated and group- specific access rights are connected with them in a similar manner to that for individual identification data and access rights, in which case the configuration of access rights data becomes significantly easier and faster.
• the activation device data of an activation device group into e.g. the sequence of the locations of a posting route, the sequence of execution of route locations can be defined, and it can if necessary be optimized.
• Fig. 2 presents the message transmission connected with the activation of an activation device in one system according to the invention.
• the activation device which transmits into its immediate surroundings the unique identification code IDa, is marked with the reference number 200.
• the terminal device 201 receives the identification code IDa and sends to the reverse proxy 202 an activation request, which comprises, in addition to the received identification code, the identification code IDp of the terminal device.
• the reverse proxy receives the activation request and transmits it to the main system 203, in which it is checked whether the access right connected with the activation request is valid at that time by comparing the identification codes of the activation request to the configured access rights data (to the associated identification codes of the terminal devices and of the activation devices) .
• the main system sends information about the approved access right (ACK) as well as any additional information (INFO) to the terminal device via the reverse proxy.
• ACK2 an activation permission
• the access right is sent in advance to the terminal device 201, it is not needed to send an activation request to the reverse proxy but instead the validity of the access right is checked immediately in the terminal device 201. In this case only the information about the activation event is sent to the reverse proxy for updating the data of the event register in the main system.
• the function is usable in situations in which the terminal device is in a blind spot at the moment of activation and does not make contact with the central system.
• Fig. 2 also presents a case in which the IP address to the server 204 maintained by the customer is added as additional information (INFO) connected with a dynamic access right.
• the terminal device sends, on the basis of the IP address, information about the activation event to the server 204 (ACK3), in response (RESP) to which the terminal device receives e.g. guidance information, instructions, information about the next locations of the distribution route, etc., that are displayable on the terminal device 201.
• Fig. 3 presents an embodiment of the invention in which a forwarding company delivers e.g. spare parts for the service vehicles 300 of a client.
• the activation device 301 is connected to the electrical lock of the door of the freight space 302 of the service vehicle 300 such that the employee of the forwarding company can open the door of the freight space with the terminal device 106 in his/her possession according to the principles presented above.
• information about the service vehicles and the delivery batches/goods batches delivered to them is transmitted from the logistics system of the client to the system 305 maintained by the forwarder.
• the forwarder configures the usage rights (access rights) required for the delivery routes in the main system for those drivers on the particular run for access to the locations according to the delivery routes.
• the goods for delivery to the locations are packed into delivery batches at the central warehouse of the client, from where the drivers of the forwarder collect them.
• the terminal device 106 in the possession of the driver checks from the main system 101 the access right of the driver to the service vehicle 300. If the access right is valid, the lock of the door of the freight space opens and the driver can leave the delivery- batch in question in the service vehicle.
• information about the visits of the driver in the service vehicle 303 are recorded in the event register of the main system as an acknowledgement of the delivery of a delivery batch.
• the forwarder can monitor arrival of delivery batches at destination by means of the monitoring tools in real-time and quickly detect e.g. deviations from the planned delivery schedule.
• the identifying code of the activation device or of the service vehicle e.g. the registration number of the service vehicle
• the mobile phone of the driver of the service vehicle is able to receive the identification code of the activation device disposed in the service vehicle, in which case it can automatically connect the position data with the notification message. If cost factors or other such factors do not restrict installation of a mobile phone equipped with a GPS locator or a similar appliance in the service vehicle, the solution in question can be used for notification and/or for real-time monitoring of the position data of the service vehicle.
• the operator installs the activation devices in the locations, opens a customer account.
• the main user of the forwarding company configures groups according to the delivery routes, and connects the necessary access rights with them, after which the employees of the forwarder can collect/deliver goods to the locations according to the distribution route.
• Car rental agency The operator installs activation devices in the vehicles of the car rental agency, by means of the doors (locks) of the vehicles can be opened.
• the activation device can also be connected with a drive prevention appliance, in which case a person without access rights cannot start the vehicle.
• After renting a vehicle e.g. using a mobile phone
• the person renting it receives terminal device software on his/her mobile phone and a dynamic access right to the rented vehicle is configured for him/her.
• the car rental agency delivers the reserved car to the renter at the agreed place, from where the renter can collect it whenever, without the keys of the car (which can be e.g. inside the car) being delivered to him/her.
• the access right is deleted in connection with the return of the car or it expires automatically at the end of the agreed rental period.
• Carrier The operator installs activation devices in the buses of the carrier and connects them with indication means, which inform drivers of the bus e.g. with a noise signal and/or a light signal about the valid travel ticket of the passenger.
• the passenger purchases from the carrier (e.g. using a mobile phone) a monthly ticket for a certain travel route or travel routes.
• terminal device software is downloaded to the- terminal device of the passenger and an access right valid for a month to the buses of the carrier that drive the routes in question is configured.
• the validity (access right) of his/her ticket is inspected automatically and the validity is indicated with an indication appliance.
• Hotelier The operator installs the activation devices in the hotel lobby and on the doors of the rooms.
• the traveler reserves a room in the hotel for a certain period of time.
• terminal device software is downloaded to the terminal device of the traveler and an access right to the room according to the reservation as well as to the elevators of the hotel is configured.
• the terminal device sends to the elevator system information about the reservation (e.g. the room number) , on the basis of which the elevator system orders an elevator for the use of the traveler.
• the traveler arrives at the door of his/her room, his/her reservation is checked a second time and if it is "OK" the lock of the room opens.
• the customer monitors the implementation of a personal fitness program on the basis of the event register, -the customer is invoiced according to the amount of fitness services used,
• multistorey car parks -an access permission to the multistorey car park is configured for customers using the multistorey car park,
• -an access permission to the different rooms/floors of a building is configured for residents and/or for the employees of servicing companies.
• the representative of the housing company e.g. the janitor monitors the use of the access permissions of the housing company.
• -access permissions to properties, and to special premises in them in which the equipment/systems of the company are situated, are configured for employees, -the access permissions are grouped and managed by region, e.g. on the basis of the city or city district .
• the invention is not limited solely to the embodiments described above, but instead many variations are possible within the scope of the inventive concept defined by the claims below. It is possible within the framework of the invention that e.g. the operator and the contractor are units belonging to the organization of the same company or association. It is also possible within the framework of the invention that the users do not belong to the organization of the contractor, but instead are in the employment of some other company or association.

Landscapes

• Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Physics & Mathematics (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Business, Economics & Management (AREA)
• Economics (AREA)
• Marketing (AREA)
• Computing Systems (AREA)
• Computer Security & Cryptography (AREA)
• Computer Hardware Design (AREA)
• Entrepreneurship & Innovation (AREA)
• Human Resources & Organizations (AREA)
• General Engineering & Computer Science (AREA)
• Operations Research (AREA)
• Quality & Reliability (AREA)
• Strategic Management (AREA)
• Tourism & Hospitality (AREA)
• General Business, Economics & Management (AREA)
• Theoretical Computer Science (AREA)
• Storage Device Security (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=38069456

Family Applications (1)

Country Status (2)

Cited By (10)

Citations (12)

• 2007
  • 2007-05-25 FI FI20070416A patent/FI20070416L/fi not_active IP Right Cessation
• 2008
  • 2008-05-23 WO PCT/FI2008/000058 patent/WO2008145803A1/en active Application Filing

Patent Citations (12)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events